Enterprise Local-First RAG

Enterprise Knowledge Retrieval with Zero Data Leakage

A private, CPU-first enterprise RAG platform powered by FastAPI, PostgreSQL/pgvector, and Ollama. Eliminates hallucinations with mathematical citation grounding and enforces SQL-level permission filtering before retrieval.

Deployment Mode

100% Air-Gapped

Operates completely on-premises with zero external runtime API calls.

Factual Verification

Strict Citations

Sentence-level word overlap validation and automatic abstention threshold.

Security Boundary

SQL-Level RBAC

Enforces tenant and role boundaries in the SQL WHERE clause before vector search.

Hardware Profile

CPU-Optimized

Dense BGE-M3 embeddings and quantized Ollama models running efficiently on CPU.

Interactive System Anatomy & Simulation

Explore how the system verifies citations, prevents information leaks, and combines hybrid retrieval legs.

Source Knowledge Base: Enterprise Compliance & Governance

Status: Verified Grounded0.96 (High Confidence)

Audited User Question

What are the mandatory retention periods for financial audit records and who can authorize early deletion?

Synthesized Response with Verifiable Citations

All financial audit workpapers and supporting ledgers must be retained for a mandatory minimum of seven years following the audit closure date . Early disposal or purge of records before statutory expiration requires written dual authorization from both the Chief Compliance Officer and the Board Audit Committee .

Citation [1] — Compliance_Policy_2026.pdf (Section 4.2)

Click citation badge to view source chunk and confidence score

“All statutory audit files, ledgers, and financial reconciliation workpapers must be preserved in immutable storage for a duration of seven (7) years following audit closure.”

Enterprise RAG Engineered for Strict Factual Truth

Built to solve the critical challenges of enterprise AI adoption: data privacy, verifiable citations, and multi-tenant security.

Local-First & Air-Gapped Ready

Runs 100% on-premises with Docker Compose, PostgreSQL, and Ollama. Zero runtime telemetry or external API calls required.

Strict Grounding & Abstention

Every generated sentence is audited for word overlap against retrieved passages. The engine abstains rather than inventing fake facts.

SQL-Level Multi-Tenant RBAC

Multi-organization isolation, granular roles (System Admin, Org Owner, Editor, Viewer), and hashed API keys for ERP integration.

Hybrid Retrieval & Reranker

Merges dense vector semantic search with PostgreSQL full-text search (tsvector). Optional BGE-Reranker-v2-m3 refines top candidates.

Asynchronous Ingestion Pipeline

Background workers process PDFs, DOCX, Markdown, and TXT files. Deterministic SHA-256 hashing eliminates redundant chunks.

Dual-Provider LLM Engine

Runs offline with Ollama by default. Organizations can optionally configure an external LLM (OpenAI/Gemini) with automatic local fallback.

End-to-End System Architecture

From decoupled multi-format document ingestion to SQL-gated semantic retrieval and audited citations.

Asynchronous Ingestion Pipeline

Document Ingestion

PDF, DOCX, Markdown, and TXT files ingested via Web UI or cryptographically hashed API keys.

Background Queue Worker

Decoupled ingestion jobs process and normalize files without blocking interactive API endpoints.

Table & Context Chunking

Preserves table associations and headers with deterministic SHA-256 chunk hashing for deduplication.

Dense Embeddings (BGE-M3)

Generates 1024-dimensional semantic vectors locally on CPU via PyTorch; no GPU or remote API required.

PostgreSQL & pgvector

Stores chunks, HNSW vector indexes, and lexical tsvector inverted indexes in unified enterprise storage.

Retrieval & Grounding Pipeline

User Query & RBAC Injection

Injects user organization ID and role visibility constraints into SQL query predicates before retrieval.

Hybrid Search Fusion

Combines dense HNSW cosine similarity with unaccented full-text search via Reciprocal Rank Fusion.

Neural Re-ranking

Cross-encoder scoring (BGE-Reranker-v2-m3) refines top candidates to maximize prompt relevancy.

Local LLM Inference

Ollama executes Llama 3.2 or Qwen locally; optional audit-logged external LLM adapter available.

Grounding Auditor

Evaluates sentence overlap against retrieved passages; triggers explicit abstention when support is below threshold.

Technical Architecture & Tech Stack

Engineered with production-tested, maintainable technologies prioritizing developer experience and zero external runtime dependencies.

Backend Services

FastAPI, Python 3.12, Pydantic v2 schemas, SQLAlchemy 2 ORM, and Alembic database migrations.

Models & Embeddings

Local Ollama models (Llama 3.2, Qwen), BAAI/bge-m3 embeddings, BAAI/bge-reranker-v2-m3, CPU-pinned PyTorch.

Database & Vector Store

PostgreSQL 16 with pgvector extension (HNSW index), PostgreSQL FTS, and unaccent dictionaries.

Frontend Application

Next.js 15, React 19, TypeScript, Tailwind CSS, and accessible custom components.

Infrastructure & DevOps

Docker Compose multi-service architecture (db, migrate, api, worker, ollama, web) with air-gapped readiness.

Testing & Verification

Vitest, React Testing Library, Pytest test suite with deterministic stub providers, strict i18n testing.

Interactive Live Demo & Evaluation

The platform comes preloaded with a demo organization, a sample knowledge base, and demo credentials, allowing you to explore its features and test it right away. For questions, feedback, or collaboration opportunities, connect with the creator, Yitsy Mosqueda, on LinkedIn.